Signed Job

In a conventional remote-management design, an agent trusts whatever arrives over its management connection: authenticate the channel once, and every command that comes down it is presumed legitimate. A signed job inverts that — the command carries its own proof, and the agent independently verifies the signature before acting.

The signature is only useful if it covers the things that would matter to an attacker. A well-constructed signed job binds the tenant, the specific device, the capability being invoked, the exact canonical parameters, a single-use nonce, and an expiry — so a captured job cannot be replayed later, re-aimed at a different machine, or edited to change what it does.

The practical consequence is a smaller blast radius from a server compromise. If the management server is breached but the signing key is held separately, the attacker can queue instructions that no agent will execute. That property is what makes signing worth the operational cost of key custody — without separate custody, a signed job is a formality.